Frequently Asked Questions about Shadowrocket

Yes. The iPhone and iPad app is available from the App Store for a one-time $2.99 purchase; the price shown in your local storefront is the amount charged. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Get desktop and Android installers from this site's download page, served from /dl/. The free versions for other platforms do not mean the iPhone and iPad App Store listing should also be free. There are two ways to get the app, depending on the platform.

Open the Shadowrocket product page and check all three details: developer Shadow Launch Technology Limited, the official app icon, and app ID 932747118. The icon should match the official icon in this site's header, and the number in the product page URL should match too. Don't rely on the name shown in search results alone. The iPhone and iPad app costs a one-time $2.99; the Mac, Windows, Android, and Linux versions are free. A free listing with the same name is not the paid app.

Check the country or region of the Apple Account used for Media & Purchases, not just your device's language and region. The app isn't available in the mainland China App Store. Open the product page linked on this site to check availability. If you need to change your account region, go to Settings, then Apple Account → Media & Purchases → View Account → Country/Region. Follow Apple's prompts and check your balance, subscriptions, and payment requirements. Changing your device region repeatedly won't change your account region.

Sign in to Media & Purchases with the Apple Account used to buy the app, then find and redownload it from your App Store purchase history. The same purchasing account can restore the app on compatible iPhone and iPad devices. The iPhone and iPad app costs a one-time $2.99; the Mac, Windows, Android, and Linux versions are free. If you're still prompted to pay, check your purchase history and current account before trying again. Restoring the app won't restore local settings that weren't backed up.

A one-time app purchase is not a subscription for proxy service. Shadowrocket reads configuration, applies rules, and connects to servers you already have; buying the app does not include a service plan. Installing it doesn't provide server details. Have your own subscription or server settings ready before importing and connecting. This site does not provide, sell, or recommend servers or subscriptions. This guide explains how to enter, configure, and troubleshoot information you already have.

App updates and subscription updates are separate. On iPhone and iPad, check Shadowrocket in the App Store's app updates list. For Mac, Windows, Android, and Linux, get the latest installer from this site's download page. A subscription update rereads your existing subscription in the app; it doesn't update the app itself. Back up your local configuration before updating the app. Before updating a subscription, note the selected server; afterward, check whether it is still listed and selected.

Open About This Mac from the Apple menu. If it shows Chip and an Apple chip name, choose the Apple silicon version. If it shows an Intel processor, choose the Intel version. Both installers are in the Mac section of this site's download page. Don't decide based only on the computer's appearance or purchase year. If macOS blocks the app after installation, confirm the file came from this site, then go to System Settings → Privacy & Security and select Open Anyway for the app if prompted.

First, make sure the installer came from this site's download page and that you're running the Shadowrocket installer you just downloaded. If SmartScreen says “Windows protected your PC,” select “More info,” verify the program, then choose “Run anyway.” If User Account Control appears, confirm as needed for the installation. Don't leave system protection disabled just to install the app. Organization-managed devices may block manual approval; contact your device administrator.

Confirm the installer came from this site and move the app to Applications. If macOS says the developer can't be verified, go to System Settings → Privacy & Security and select Open Anyway. If it says the app is damaged, download it again and replace the existing copy. After confirming the source, you can run xattr -cr /Applications/Shadowrocket.app in Terminal and try opening it again. This command targets only that app path; don't apply it to the entire disk. Follow your administrator's security policy on managed devices.

If the download doesn't work in WeChat, open this site's download page in your system browser and get the Android installer there. If the system blocks installation, open “Install unknown apps” in Settings and grant permission only to the browser or file manager you're using. You can turn it off afterward. This site provides an arm64 installer. If your device reports incompatibility, check its architecture and the system message. Installation can also fail if the file didn't download completely or storage is low; don't keep tapping Install repeatedly.

Choose based on your distribution: Debian- and Ubuntu-based systems usually use deb; Fedora and similar systems usually use rpm. For a directly runnable package, consider AppImage. Get all installers from this site's download page. For deb, run sudo apt install followed by the local path to the downloaded file. For rpm, use sudo dnf install followed by the local path. Before running an AppImage for the first time, use chmod +x followed by its file path to make it executable. If your system blocks it, follow your system's approval process. Don't run the graphical app as root.

You can install it on a compatible iPad; check the App Store listing for system requirements. The iPhone and iPad app costs a one-time $2.99 in the App Store. The Mac, Windows, Android, and Linux versions are free. After opening the app for the first time, import your own configuration before connecting. If the system asks to add a VPN configuration, confirm that Shadowrocket initiated the request, then allow it. This permission sets up a local network routing entry; it doesn't provide a server to connect to.

Make sure you copied the complete subscription link you already have, not a provider's login or information page. Check for leading or trailing spaces, line breaks, and truncated parameters. Then confirm your current network can reach the subscription URL and identify whether the error is a timeout, authentication failure, or format parsing error. For authentication failures, check that the link is still valid; for parsing errors, check the output format. Subscription links may contain access credentials, so don't include the full link in public screenshots or troubleshooting notes.

In Home, find the relevant subscription group and use its update action. When it finishes, check whether the entries changed. If Settings offers an option to update on launch, enable it if you want; the option's location may vary by version, so check the current interface. Automatic updates save you from triggering updates manually, but they won't fix an expired link or network issue. If an update removes the previously selected server, choose an available entry again. A successful update doesn't prove that every server can connect.

Yes. Make sure the QR code comes from server information you already have, is fully visible and clear, and that camera access is allowed. A web address or login verification code may not be an importable server QR code. If scanning still fails, open Add Server, select the protocol specified in your source information, and enter the server, port, and authentication details. Include all protocol-required parameters. After saving, check capitalization, spaces, and the port, then test connectivity.

No. Subscribe is generally used to read and update a set of server entries. Config manages settings such as rules and DNS; the two serve different purposes and are accessed in different places. Importing a subscription URL as a configuration file can cause a parsing error. Updating a subscription alone won't replace the current rules. Before importing, confirm what your information is for. Back up the current file before changing configuration, then check Global Routing and the selected server after applying it. Avoid changing several things at once, so you can identify the cause if something goes wrong.

In Add Server, choose the protocol that exactly matches your original server details, such as Shadowsocks, VMess, VLESS, or Trojan. Don't enter only an address and port, then pick a protocol at random. Check each authentication detail, encryption method, transport, and TLS field. Don't guess values for fields the server doesn't require. Saving successfully only means the information was entered; it doesn't mean the remote server has been verified. If the connection fails, compare each field with your original details, then test network reachability.

Screenshots are useful for recording toggle states, but they aren't a substitute for a full configuration backup. Before changing devices, save your own subscription URL and use the app's export or backup feature to preserve local configuration. Make sure the exported file can be read. Backups may contain server credentials, so store them somewhere you control. After restoring on the new device, check the current configuration, selected server, and system VPN permission. Restoring local rules and downloading the app again are separate steps.

The three common modes are Config, Proxy, and Direct. Config routes requests according to the rules in the current configuration. Proxy sends applicable requests through the selected proxy server. Direct connects without a proxy. For everyday rule-based routing, start with Config. To troubleshoot, you can temporarily switch to Proxy or Direct and compare results for the same destination. Change only one condition at a time and restore the original mode after testing. Switching modes won't fix incorrect server settings.

First, check that a server is selected and that you allowed the VPN configuration when connecting for the first time. If you previously denied permission or deleted the system VPN entry, return to Shadowrocket, start the connection again, and follow the prompts to grant permission. Then check whether another VPN connection or device management policy is occupying the required resources. If needed, stop the conflicting connection and try again. If the switch still turns off immediately, note the system message and app logs. Don't repeatedly delete all configurations; back them up before rebuilding anything.

Disconnect first and confirm that your Wi-Fi or cellular connection works on its own. Then check the selected server and the Connectivity Test result. Next, review Global Routing, DNS, and the rule that actually matched the request, especially whether the FINAL policy is what you expect. If only some sites fail, note their domains and check the relevant logs instead of changing every setting right away. Change one thing at a time and retest the same destination. A system status of VPN connected means the tunnel is established; it doesn't guarantee every request will succeed.

First determine whether the domain fails to resolve or whether the connection fails after resolution. Check the DNS settings in the current Config, then see which Rule matched the request. DOMAIN-SUFFIX matches a domain and its subdomains; IP-CIDR matches an IP address range. An applicable rule earlier in the list may determine the policy first, while FINAL should be the last fallback rule. Don't stack similar rules and guess. Keep only the minimum necessary rules, record which one matched, then restore rules one at a time and retest.

This guide keeps interface labels in English, so look for Home, Add Server, Config, Settings, Global Routing, and On Demand in the app. The displayed labels may depend on your system language, app language settings, and app version. If your system offers a separate language setting for the app, check the app's settings in the system. Don't identify features by icon position alone; check the English labels. If you can't find an option, first follow the steps in Getting Started, then confirm which page you're on.

Compare battery usage over similar periods in your system's battery settings, and check for ongoing downloads, frequent reconnections, or excessive diagnostic logging. On Demand starts connections when its conditions are met; if those conditions are too broad, it may keep connecting when you don't need it. You can temporarily disable it and monitor the difference, but don't assume it's the cause of every battery issue. Avoid repeated tests and overly frequent subscription refreshes, and check network stability. Keep your usage similar when comparing; a single drop in battery level isn't enough to show the app is at fault.